@dbx-tools/projen 0.9.40 → 0.9.46

package/README.md

@@ -4,21 +4,20 @@ Projen engine for Bun-first dbx-tools workspaces.
 
 Import this package from `.projenrc.ts` when a repository should discover
 packages from the filesystem and generate manifests, tsconfigs,
-barrels, OpenAPI clients, codegen outputs, and release tasks.
+barrels, codegen outputs, and release tasks.
 
 Key features:
 
 - Filesystem package discovery: every `src`-bearing folder under configured
   workspace roots becomes a TypeScript package.
 - Tag-driven runtime defaults for shared libraries, Node packages, CLIs,
-  servers, OpenAPI clients, and React/browser UI packages.
+  servers, and React/browser UI packages.
 - Generated package manifests, tsconfigs, package-root barrels, Bun app configs,
   VS Code settings, and a committed `pnpm-workspace.yaml` retained for
   Databricks Apps deployment.
 - Extensible mixin system so repositories can add deps, tasks, or generated
   files based on package predicates.
-- OpenAPI client generation from tsoa controllers and zod schema generation from
-  `.d.ts` inputs.
+- Zod schema generation from `.d.ts` inputs.
 - Read-only generated-file ownership, cleanup, and watch-loop helpers.
 
 ## Define A Workspace Root
@@ -58,18 +57,16 @@ workflow.
 Repository policy stays in the consuming `.projenrc.ts`:
 
 - `releaseDocs` supplies repository-defined preparation and build steps plus
-  the Pages artifact path. The engine adds release checkout, Bun caching,
-  artifact upload, and deployment without naming a docs script or output tree.
+  the Pages artifact path. The engine adds release checkout, artifact upload,
+  and deployment without naming a docs script or output tree.
 - `releasePythonRoot` passes the actual Python package root to local release
   preparation. Omit it when the workspace has no standard Python packages.
 - `releaseValidationTasks` names repository tasks that must pass in tag CI
   before release artifacts are built and published.
 - `releaseSetupSteps` installs any extra validation/build prerequisites in the
   shared release job before the validation tasks run.
-- `pullRequestTitlePolicy` configures semantic title types and scope policy.
-  Omit it or pass `false` to disable the title job.
-- `workflowCacheIgnorePaths` excludes generated output trees that may contain
-  package manifests from the dependency-only Bun cache key.
+- `releaseSynthesisCommands` runs repository-specific synth owners before the
+  root synthesis and clean-diff release check.
 - `extraWorkspaceMembers` declares self-synthesizing tooling packages outside
   `packageRoots`. Their version, generated entrypoint, formatting, linting, and
   workspace membership are derived from that declaration.
@@ -228,7 +225,7 @@ parameter to `Project`). Drop to `mixin.create(predicate, fn)` +
 `project.with(...)` only when you need a predicate the filters cannot express.
 
 Built-in tag mixins set runtime defaults for `shared`, `node`, `cli`, `server`,
-`ui`, and `openapi`. Repo-specific mixins layer package-specific dependencies,
+and `ui`. Repo-specific mixins layer package-specific dependencies,
 scripts, and generated files on top.
 
 AppKit 0.81's `appkitServerConfig()` is the preferred tsdown preset for a
@@ -272,12 +269,19 @@ codegen.generateCodegen();
 barrels.generateBarrels();
 ```
 
-`generateCodegen()` reads `package.json` `codegen.inputs` and writes generated
-schema modules. They are written read-only, and the root ESLint task runs with
-an explicit separate fix task, so each generated module is added to
-`ignorePatterns` at synth - named individually via `codegen.codegenModulePaths()`,
-never as a blanket `<package>/src/**`. A codegen package may hold hand-written
-modules beside its generated ones, and those must stay linted.
+Add declaration inputs through the owning package's typed config:
+
+```ts
+pkg.dbxToolsConfig.codegenInputs.push("node_modules/example/model.d.ts");
+```
+
+`generateCodegen()` reads the serialized `dbxToolsConfig.codegenInputs` and
+writes generated schema modules. They are written read-only, and the root
+ESLint task runs with an explicit separate fix task, so each generated module is
+added to `ignorePatterns` at synth - named individually via
+`codegen.codegenModulePaths()`, never as a blanket `<package>/src/**`. A codegen
+package may hold hand-written modules beside its generated ones, and those must
+stay linted.
 
 `generateBarrels()` writes package-root `index.ts` barrels with module
 namespaces, flat unique type exports, and `PACKAGE_IDENTIFIER`, returning the
@@ -290,17 +294,6 @@ package is attempted even if one fails; the failures are re-thrown together as a
 `AggregateError` naming each package, rather than the first one abandoning the
 rest of the sweep.
 
-## Generate OpenAPI Clients
-
-```ts
-import { openapi } from "@dbx-tools/projen";
-
-const packages = await openapi.generateOpenapi();
-```
-
-OpenAPI generation scans packages for tsoa controllers, emits `openapi.json`,
-generates TypeScript schemas, and adds an `openapi-fetch` client.
-
 ## Configure pnpm Catalogs
 
 ```ts
@@ -351,7 +344,6 @@ file contract as the CLI.
 - `pnpmWorkspace` - generated pnpm workspace file and catalog model.
 - `barrels` / `moduleExports` - public entrypoint generation.
 - `codegen` - `.d.ts` to zod schema generation.
-- `openapi` - tsoa/OpenAPI package generation.
 - `bunApp` / `tsconfig` / `vscode` - generated support files/components.
 - `generated` / `clean` / `watch` / `scaffold` - read-only file ownership,
   cleanup, watchers, and synth orchestration.
@@ -359,17 +351,17 @@ file contract as the CLI.
 - `engineRoot` - engine package root resolution for bootstrapped repos.
 
 The engine registers its commands as projen tasks on the workspace root, so run
-them with `bun run <task>` - `sync` (add `--watch`), `barrels`, `openapi`, and
-`clean`.
+them with `bun run <task>` - `sync` (add `--watch`), `barrels`, and `clean`.
 [`@dbx-tools/cli`](../packages/js/cli/dbx-tools) is only needed to
 bootstrap a folder that has no `.projenrc.ts` or toolchain yet.
 
 ## Run Tasks From The ROOT
 
-Every repo-wide task lives on the root. `compile` batches ordinary TypeScript
-packages in up to four `tsc --build` processes and runs custom compile tasks alongside them;
-`test` delegates with `bun run --filter '*'`. Both read the current workspace
-list, so a new package is covered without a re-synth. Work from the root:
+Every repo-wide task lives on the root. `compile` batches package tsconfigs in
+up to four `tsc --build` processes and runs package-owned compile lifecycles
+alongside them; `test` delegates with `bun run --filter '*'`. Both read the
+current workspace list, so a new package is covered without a re-synth. Work
+from the root:
 
 | Task                    | What it does                                        |
 | ----------------------- | --------------------------------------------------- |
@@ -389,10 +381,10 @@ diverged. From `main`, it calls the existing `bump` task, commits the generated
 version changes, pushes `main`, and pushes the matching annotated `vX.Y.Z` tag.
 Pass `--no-bump` only to release an existing synchronized local bump. The tag
 workflow verifies that the tag points at the exact `origin/main` commit. One
-`build-release` job restores the Bun cache and installs workspace dependencies,
-runs validation, packs the npm archives, builds all Python distributions, and
-builds the documentation site. Install validation prerequisites through
-`releaseSetupSteps`; `releaseDocs.prepareSteps` runs after validation.
+`build-release` job installs workspace dependencies, runs validation, packs the
+npm archives, builds all Python distributions, and builds the documentation
+site. Install validation prerequisites through `releaseSetupSteps`;
+`releaseDocs.prepareSteps` runs after validation.
 
 Publication jobs download the resulting artifacts rather than rebuilding the
 workspace. Each Python package retains its own publishing environment and waits
@@ -413,7 +405,7 @@ bun run release --local-registry false --local-pypi auto
 ```
 
 `--install auto` keeps Projen's normal local dependency-install behavior;
-`always` performs a frozen install first, and `never` uses dependencies already
+`always` performs a manifest-resolved install first, and `never` uses dependencies already
 installed while still regenerating versioned sources. `--no-validation` skips
 optional task checks locally and in CI, not version or immutable-source checks.
 `--no-docs` skips building and deploying the site, not package README validation.
@@ -426,8 +418,8 @@ invokes, so there is no second place to run the same thing:
 
 - `compile` / `test` - what the root's `--filter '*'` delegation calls.
 - `prepack` - standalone-publish safety that compiles one package before packing
-  (27 of 33 members; the workspace release driver compiles them from the root
-  and publishes with lifecycle scripts disabled).
+  when that package has a compiled publication surface; the workspace release
+  driver compiles from the root and publishes with lifecycle scripts disabled.
 - `watch` - a single-package `tsc --build -w`, for narrowing a long
   edit/compile loop to one package.
 - `build` / `package` - a complete compile/test/pack lifecycle when invoked in
@@ -458,33 +450,32 @@ workflow order without introducing another version owner.
 
 ### `release`
 
-```text
-Usage: release [options]
-
 Prepare an annotated release and select its build and publication steps
 
-Options:
-  --root <path>                      repository root
-  --branch <name>                    release branch (default: "main")
-  --prefix <prefix>                  release tag prefix (default: "v")
-  --remote <name>                    git remote (default: "origin")
-  --python-root <path>               Python package root for local publish (default: "packages/py")
-  --validate <task>                  task to run before pushing (default: [])
-  --no-bump                          use an existing synchronized local version bump
-  --publish <target>                 publication scope (choices: "auto", "npm", "pypi", "local",
-                                     "none", default: "auto")
-  --install <mode>                   local workspace dependency installation (choices: "auto",
-                                     "always", "never", default: "auto")
-  --no-npm                           skip npm build and publication, including local npm publication
-  --no-pypi                          skip Python build and publication, including local Python
-                                     publication
-  --docs                             build and deploy docs for a selected scope
-  --no-docs                          skip documentation build and deployment
-  --no-validation                    skip optional release validation tasks; version/source checks
-                                     remain mandatory
-  --no-local-publish                 skip publishing to configured local registries
-  --local-registry <auto|false|url>  local npm registry selection (default: "auto")
-  --local-pypi <auto|false|url>      local devpi registry selection (default: "auto")
+```sh
+release [options]
 ```
 
+#### Options
+
+| Option                                | Description                                                                                   |
+| ------------------------------------- | --------------------------------------------------------------------------------------------- |
+| `--root <path>`                       | repository root                                                                               |
+| `--branch <name>`                     | release branch (default: "main")                                                              |
+| `--prefix <prefix>`                   | release tag prefix (default: "v")                                                             |
+| `--remote <name>`                     | git remote (default: "origin")                                                                |
+| `--python-root <path>`                | Python package root for local publish (default: "packages/py")                                |
+| `--validate <task>`                   | task to run before pushing (default: [])                                                      |
+| `--no-bump`                           | use an existing synchronized local version bump                                               |
+| `--publish <target>`                  | publication scope (choices: "auto", "npm", "pypi", "local", "none", default: "auto")          |
+| `--install <mode>`                    | local workspace dependency installation (choices: "auto", "always", "never", default: "auto") |
+| `--no-npm`                            | skip npm build and publication, including local npm publication                               |
+| `--no-pypi`                           | skip Python build and publication, including local Python publication                         |
+| `--docs`                              | build and deploy docs for a selected scope                                                    |
+| `--no-docs`                           | skip documentation build and deployment                                                       |
+| `--no-validation`                     | skip optional release validation tasks; version/source checks remain mandatory                |
+| `--no-local-publish`                  | skip publishing to configured local registries                                                |
+| `--local-registry <auto\|false\|url>` | local npm registry selection (default: "auto")                                                |
+| `--local-pypi <auto\|false\|url>`     | local devpi registry selection (default: "auto")                                              |
+
 <!-- cli-reference:end -->

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.40";
+export const PACKAGE_VERSION = "0.9.46";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";
@@ -14,7 +14,6 @@ export * as engineRoot from "./src/engine-root.ts";
 export * as generated from "./src/generated.ts";
 export * as mixin from "./src/mixin.ts";
 export * as moduleExports from "./src/module-exports.ts";
-export * as openapi from "./src/openapi.ts";
 export * as packages from "./src/packages.ts";
 export * as pnpmWorkspace from "./src/pnpm-workspace.ts";
 export * as project from "./src/project.ts";
@@ -37,9 +36,8 @@ export * as workspaceLock from "./src/workspace-lock.ts";
 export * as workspaceVersion from "./src/workspace-version.ts";
 export { BUN_DEV_OVERRIDE, BUN_BUILD_OVERRIDE, BUN_APP_OVERRIDES, RootBunfigFile, BunfigFile, BunDevServerFile, BunBuildFile } from "./src/bun-app.ts";
 export { BUN_VERSION } from "./src/bun-workflow.ts";
-export type { BunWorkflowCacheOptions } from "./src/bun-workflow.ts";
-export { DBXToolsConfig } from "./src/dbx-tools-config.ts";
-export type { DBXToolsConfigOptions } from "./src/dbx-tools-config.ts";
+export { DBXToolsConfigDataSchema, DBXToolsConfig } from "./src/dbx-tools-config.ts";
+export type { DBXToolsConfigOptions, DBXToolsConfigData } from "./src/dbx-tools-config.ts";
 export { resolvePkgRoot } from "./src/engine-root.ts";
 export type { HeaderOpts } from "./src/generated.ts";
 export type { ConstructsMixin } from "./src/mixin.ts";
@@ -49,8 +47,8 @@ export type { RecordedPackage } from "./src/packages.ts";
 export { PnpmWorkspaceState } from "./src/pnpm-workspace.ts";
 export type { Catalog, AllowBuilds, DBXToolsPNPMWorkspaceOptions } from "./src/pnpm-workspace.ts";
 export type { DBXToolsProjectLanguage, DBXToolsProjectOptions, DBXToolsProject, ApplyToProjectsOptions } from "./src/project.ts";
-export { PackageIdentifier, DBX_TOOLS_LICENSE, DBXToolsNodeProject, ROOT_INSTALL_ONLY_MIXIN, DBXToolsTypeScriptProject } from "./src/project-js.ts";
-export type { DBXToolsJavaScriptProject, DBXToolsReleaseMode, DBXToolsJavaScriptProjectOptions, DBXToolsTypeScriptProjectOptions } from "./src/project-js.ts";
+export { PackageIdentifier, LICENSE, DBXToolsNodeProject, ROOT_INSTALL_ONLY_MIXIN, DBXToolsTypeScriptProject } from "./src/project-js.ts";
+export type { DBXToolsJavaScriptProject, DBXToolsReleaseMode, DiscoveredTypeScriptPackageOptions, DBXToolsJavaScriptProjectOptions, DBXToolsTypeScriptProjectOptions } from "./src/project-js.ts";
 export { DBXToolsPythonProject, DBXToolsPythonWorkspace } from "./src/project-py.ts";
 export type { PythonRepositoryOptions, PythonPackageOptions, DBXToolsPythonProjectOptions, PythonReleaseOptions, DBXToolsPythonWorkspaceOptions } from "./src/project-py.ts";
 export { PROJEN_VERSION } from "./src/projen-version.ts";
@@ -62,7 +60,7 @@ export type { PythonNodeFunctionOverride, PythonNodeBindingsOptions, PythonNodeB
 export { DBXToolsRelease } from "./src/release.ts";
 export type { ReleaseDocsOptions, DBXToolsReleaseOptions } from "./src/release.ts";
 export { RELEASE_VERSION } from "./src/release-context.ts";
-export { RELEASE_PUBLISH_TARGETS, RELEASE_INSTALL_MODES } from "./src/release-options.ts";
+export { RELEASE_PUBLISH_TARGETS, RELEASE_INSTALL_MODES, ReleaseStepSelectionSchema } from "./src/release-options.ts";
 export type { ReleasePublishTarget, ReleaseInstallMode, ReleaseStepSelection, ReleaseSelectionOptions } from "./src/release-options.ts";
 export { AGNOSTIC_COMPILER_OPTIONS, PACKAGE_TAG_MIXINS } from "./src/tags.ts";
 export type { PackageTag } from "./src/tags.ts";

package/package.json

@@ -16,7 +16,6 @@
     "post-upgrade": "projen post-upgrade",
     "pre-compile": "projen pre-compile",
     "test": "projen test",
-    "test:external-consumer": "projen test:external-consumer",
     "upgrade": "projen upgrade",
     "watch": "projen watch",
     "projen": "projen"
@@ -24,29 +23,28 @@
   "devDependencies": {
     "@types/node": "^24.6.0",
     "@types/semver": "^7.7.1",
-    "projen": "0.103.27",
-    "tsoa": "^6.6.0"
+    "projen": "0.103.27"
   },
   "peerDependencies": {
     "projen": "^0.103.27"
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.40",
-    "@dbx-tools/path": "^0.9.40",
-    "@dbx-tools/shared-core": "^0.9.40",
+    "@dbx-tools/core": "^0.9.46",
+    "@dbx-tools/path": "^0.9.46",
+    "@dbx-tools/shared-core": "^0.9.46",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
     "is-identifier": "^1",
     "node-stdlib-browser": "^1.3.1",
-    "openapi-typescript": "^7.13.0",
     "oxc-parser": "^0.90.0",
     "semver": "^7.7.3",
     "smol-toml": "1.8.0",
     "ts-to-zod": "^5.1.0",
     "typescript": "^5.9.3",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.0",
+    "zod": "^4.3.6"
   },
   "devEngines": {
     "packageManager": {
@@ -56,7 +54,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.40",
+  "version": "0.9.46",
   "types": "index.ts",
   "type": "module",
   "exports": {
@@ -67,7 +65,8 @@
   "files": [
     "index.ts",
     "src",
-    "tasks"
+    "tasks",
+    "shims/python-node"
   ],
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"bunx projen\"."
 }

package/shims/python-node/bootstrap.ts

@@ -0,0 +1,129 @@
+import { Buffer } from "node:buffer";
+
+import { PythonHeaders } from "./headers.ts";
+import { installPythonGlobals, pythonHost } from "./host.ts";
+
+installPythonGlobals();
+
+(globalThis as typeof globalThis & { Buffer?: typeof Buffer }).Buffer = Buffer;
+
+const globals = globalThis as typeof globalThis & {
+  AbortController?: typeof AbortController;
+  Headers?: typeof Headers;
+  Request?: typeof Request;
+  Response?: typeof Response;
+  structuredClone?: typeof structuredClone;
+  TextDecoder?: typeof TextDecoder;
+  TextEncoder?: typeof TextEncoder;
+  fetch?: typeof fetch;
+};
+globals.AbortController ??= class AbortController {
+  readonly signal: AbortSignal;
+  readonly #listeners = new Set<() => void>();
+
+  constructor() {
+    this.signal = {
+      aborted: false,
+      addEventListener: (name: string, listener: EventListenerOrEventListenerObject) => {
+        if (name === "abort") {
+          this.#listeners.add(
+            typeof listener === "function"
+              ? () => listener(new Event("abort"))
+              : () => listener.handleEvent(new Event("abort")),
+          );
+        }
+      },
+      removeEventListener: () => {},
+    } as AbortSignal;
+  }
+
+  abort(): void {
+    if (this.signal.aborted) return;
+    Object.defineProperty(this.signal, "aborted", { value: true });
+    for (const listener of this.#listeners) listener();
+    this.#listeners.clear();
+  }
+} as typeof AbortController;
+
+globals.Headers ??= PythonHeaders as unknown as typeof Headers;
+
+class PythonResponse {
+  readonly headers: Headers;
+  readonly ok: boolean;
+  readonly status: number;
+  readonly #body: Uint8Array;
+
+  constructor(body: Uint8Array, init: ResponseInit = {}) {
+    this.#body = body;
+    this.status = init.status ?? 200;
+    this.ok = this.status >= 200 && this.status < 300;
+    this.headers = new Headers(init.headers);
+  }
+
+  async arrayBuffer(): Promise<ArrayBuffer> {
+    return this.#body.slice().buffer;
+  }
+
+  async text(): Promise<string> {
+    return new TextDecoder().decode(this.#body);
+  }
+
+  async json(): Promise<unknown> {
+    return JSON.parse(await this.text());
+  }
+}
+
+globals.Response ??= PythonResponse as unknown as typeof Response;
+globals.structuredClone ??= ((value: unknown) => cloneStructured(value)) as typeof structuredClone;
+globals.TextEncoder ??= class TextEncoder {
+  encode(value: string): Uint8Array {
+    const encoded = unescape(encodeURIComponent(String(value)));
+    return Uint8Array.from(encoded, (character) => character.charCodeAt(0));
+  }
+} as typeof TextEncoder;
+globals.TextDecoder ??= class TextDecoder {
+  decode(value?: ArrayBuffer | ArrayBufferView): string {
+    const bytes =
+      value instanceof ArrayBuffer
+        ? new Uint8Array(value)
+        : value
+          ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength)
+          : new Uint8Array();
+    const encoded = Array.from(bytes, (byte) => String.fromCharCode(byte)).join("");
+    return decodeURIComponent(escape(encoded));
+  }
+} as typeof TextDecoder;
+globals.fetch ??= (async (input: string | URL | Request, init: RequestInit = {}) => {
+  const request = typeof input === "object" && "url" in input ? input : undefined;
+  const headers = init.headers ?? request?.headers;
+  const response = await pythonHost().http.fetch(
+    request?.url ?? String(input),
+    init.method ?? request?.method,
+    headers ? Object.fromEntries(new Headers(headers).entries()) : undefined,
+    typeof init.body === "string" ? init.body : undefined,
+  );
+  return new Response(Uint8Array.from(response.body), {
+    status: response.status,
+    headers: response.headers,
+  });
+}) as typeof fetch;
+
+function cloneStructured(value: unknown, seen = new Map<object, unknown>()): unknown {
+  if (value === null || typeof value !== "object") return value;
+  const cached = seen.get(value);
+  if (cached !== undefined) return cached;
+  if (value instanceof Date) return new Date(value.getTime());
+  if (Array.isArray(value)) {
+    const clone: unknown[] = [];
+    seen.set(value, clone);
+    for (const item of value) clone.push(cloneStructured(item, seen));
+    return clone;
+  }
+  if (Object.getPrototypeOf(value) === Object.prototype) {
+    const clone: Record<string, unknown> = {};
+    seen.set(value, clone);
+    for (const [key, item] of Object.entries(value)) clone[key] = cloneStructured(item, seen);
+    return clone;
+  }
+  throw new TypeError(`PythonMonkey structuredClone does not support ${value.constructor.name}`);
+}

package/shims/python-node/child-process.ts

@@ -0,0 +1,96 @@
+import { EventEmitter } from "node:events";
+import { Readable, Writable } from "node:stream";
+
+import { pythonHost, type PythonProcessHandle } from "./host.ts";
+
+interface SpawnOptions {
+  env?: Record<string, string>;
+  signal?: AbortSignal;
+}
+
+class PythonChildProcess extends EventEmitter {
+  readonly pid = undefined;
+  readonly stdin = new Writable({ write: (_chunk, _encoding, callback) => callback() });
+  readonly stdout = new Readable({ read() {} });
+  readonly stderr = new Readable({ read() {} });
+  private active = true;
+  private readonly handle: PythonProcessHandle;
+
+  constructor(command: string, args: string[], options: SpawnOptions) {
+    super();
+    this.handle = pythonHost().process.start(command, args, options.env, undefined);
+    options.signal?.addEventListener("abort", () => {
+      if (!this.active) return;
+      this.active = false;
+      // Actually terminate the Python child so an aborted call leaks nothing.
+      this.handle.kill();
+      this.stdout.push(null);
+      this.stderr.push(null);
+      this.emit(
+        "error",
+        Object.assign(new Error("Process execution was aborted"), { code: "ABORT_ERR" }),
+      );
+    });
+    void this.handle.wait().then(
+      (result) => {
+        if (!this.active) return;
+        this.active = false;
+        if (result.stdout) this.stdout.push(result.stdout);
+        if (result.stderr) this.stderr.push(result.stderr);
+        this.stdout.push(null);
+        this.stderr.push(null);
+        this.emit("close", result.exitCode);
+        this.emit("exit", result.exitCode);
+      },
+      (error) => {
+        if (!this.active) return;
+        this.active = false;
+        this.stdout.push(null);
+        this.stderr.push(null);
+        this.emit("error", error);
+      },
+    );
+  }
+
+  kill(): boolean {
+    this.handle.kill();
+    return true;
+  }
+}
+
+export function spawn(command: string, args: string[] = [], options: SpawnOptions = {}) {
+  return new PythonChildProcess(command, args, options);
+}
+
+export function execFile(
+  command: string,
+  args: string[],
+  _options: object,
+  callback: (error: Error | null, result?: { stdout: string; stderr: string }) => void,
+): void {
+  void pythonHost()
+    .process.start(command, args, undefined, undefined)
+    .wait()
+    .then(
+      (result) => {
+        if (result.exitCode === 0) {
+          callback(null, { stdout: result.stdout ?? "", stderr: result.stderr ?? "" });
+        } else {
+          callback(
+            Object.assign(new Error(result.stderr || `Command exited ${result.exitCode}`), {
+              code: result.exitCode,
+            }),
+          );
+        }
+      },
+      (error) => callback(error instanceof Error ? error : new Error(String(error))),
+    );
+}
+
+export function spawnSync(): never {
+  throw Object.assign(new Error("Synchronous subprocesses are unavailable in PythonMonkey"), {
+    code: "ENOSYS",
+  });
+}
+
+export default { execFile, spawn, spawnSync };

package/shims/python-node/crypto.ts

@@ -0,0 +1,60 @@
+import { pythonHost } from "./host.ts";
+
+class PythonHash {
+  private readonly content: number[] = [];
+
+  constructor(private readonly algorithm: string) {}
+
+  update(value: string | ArrayBuffer | ArrayBufferView): this {
+    const bytes =
+      typeof value === "string"
+        ? new TextEncoder().encode(value)
+        : value instanceof ArrayBuffer
+          ? new Uint8Array(value)
+          : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    this.content.push(...bytes);
+    return this;
+  }
+
+  digest(encoding?: "hex" | "base64"): string | Uint8Array {
+    const digest = pythonHost().crypto.digest(this.algorithm, this.content, encoding);
+    if (typeof digest === "string") return digest;
+    const bytes = Uint8Array.from(digest) as Uint8Array & {
+      readBigInt64BE(offset: number): bigint;
+    };
+    bytes.readBigInt64BE = (offset) => {
+      let value = 0n;
+      for (const byte of bytes.slice(offset, offset + 8)) {
+        value = (value << 8n) | BigInt(byte);
+      }
+      return BigInt.asIntN(64, value);
+    };
+    return bytes;
+  }
+}
+
+export function createHash(algorithm: string): PythonHash {
+  const normalized = algorithm.toLowerCase();
+  if (!getHashes().includes(normalized)) {
+    throw new Error(`Unsupported hash algorithm: ${algorithm}`);
+  }
+  return new PythonHash(normalized);
+}
+
+export function getHashes(): string[] {
+  return pythonHost().crypto.hashes();
+}
+
+export function randomBytes(length: number): Uint8Array {
+  return Uint8Array.from(pythonHost().crypto.randomBytes(length));
+}
+
+export function randomUUID(): string {
+  const bytes = randomBytes(16);
+  bytes[6] = (bytes[6]! & 0x0f) | 0x40;
+  bytes[8] = (bytes[8]! & 0x3f) | 0x80;
+  const hex = Array.from(bytes, (value) => value.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
+export default { createHash, getHashes, randomBytes, randomUUID };